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DETAILED ACTION 

1 . Claims 1-30 are pending in this office action. 

2. Applicant's arguments (including the affidavit), file June 28, 2005, have been 
considered and are persuasive. However, a new ground of rejection is made. 

Rejections 

3. The text of those sections of Title 35, U.S. Code not included in this action can 
be found in a prior Office action. 

Claim Rejections - 35 USC § 103 

4. Claims 1-30 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Gupta et al. (U.S. Patent No. 6,658,565) in view of Munqer et al. (U.S. Patent No. 
6,502,135). 

Regarding claims 1 and 16: Gupta et al. discloses a method/apparatus for 
tracing a sequence of packets to a potential source thereof within a communications 
network, the sequence of packets being received at a target host in said 
communications network at a received packet rate, the method comprising the steps of: 
• For each selected network element, measuring a change in said received packet 

rate in response to said application of said burst load to said selected network 

element (col. 7, line 66 through col. 8, line 2); and 
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• Determining said potential source of said sequence of packets based on said 
measured changes in said received packet rate (col. 8, lines 2-4). 

Gupta et al. does not teach applying a burst load to each of one or more selected 
network elements in said communications network. 

Munger et al. teaches applying a burst load to each of one or more selected 
network elements in said communications network (col. 10, lines 6-21). 

It would have been obvious to one of ordinary skill in the art, at the time the 
invention was made, to combine applying burst loads to each network element, as 
taught by Munger et al. , with the method/apparatus of Gupta et al. It would have been 
obvious for such modifications because bursts of packets on a network element can 
help determine the identities of the sender and receiver (see col. 2, lines 49-51 of 
Munger et al.). 

Regarding claims 2 and 17: Gupta et al. as modified by Munger et al. discloses 
wherein said communications network comprises the Internet (see col. 2, lines 51-56 of 
Gupta et al.). 
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Regarding claims 3 and 18: Gupta et al. as modified by Munger et al. discloses 
wherein each of said selected network elements comprises a network link (see fig. 2, 
ref. num 208 of Gupta et al.). 

Regarding claims 4 and 19: Gupta et al. as modified by Munger et al. discloses 
wherein said step of applying a burst load to said network link comprises transmitting 
packets to a sub network of said communications network to initiate a responsive flow of 
packets through said network link (see col. 4, lines 35-42 of Munger et al.). 

Regarding claim 5 and 20: Gupta et al. as modified by Munger et al. discloses 
wherein said transmitted packets are spoofed from an end of said network link closest 
to said target host (see col. 3, lines 42-48 of Gupta et al., DoS attacks are performed by 
spoofing the source address). 

Regarding claims 6 and 21: Gupta et al. as modified by Munger et al. discloses 
wherein said transmitted packets comprise UDP chargen requests (see col. 9, lines 64- 
65 of Munger et al.). 

Regarding claims 7 and 22: Gupta et al. as modified by Munger et al. discloses 
wherein each of said selected network elements comprises a network router (see col. 1, 
line 25 of Gupta et al.). 
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Regarding claims 8 and 23: Gupta et al. as modified by Munger et al. discloses 
further comprising the step of generating a map comprising routes from said target host 
to a plurality of sub networks of said communications network (see col. 1, line 25, a 
router is known to have a routing table of all sub network elements connected to it). 

Regarding claims 9 and 24: Gupta et al. as modified by Munger et al. discloses 
further comprising the step of eliminating said selected network element from 
consideration as said potential source of said sequence of packets when said change in 
said received packet rate meets a predetermined criterion (see col. 7, line 66 through 
col. 8, line 6 of Gupta et al.). 

Regarding claims 10 and 25: Gupta et al. as modified by Munger et al. discloses 
wherein said predetermined criterion comprises a determination of whether said change 
in said received packet rate is less than a predetermined threshold (see col. 8, lines 2-6 
of Gupta et al.). 

Regarding claims 1 1 and 26: Gupta et al. as modified by Munger et al. discloses 
wherein said step of eliminating said selected network element from consideration also 
eliminates from consideration one or more sub networks of said communications 
network which are connected to said selected network element (see col. 8, lines 2-6 of 
Gupta et al., sub networks, which are connected to the parent network element, would 
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inherently be eliminated from suspicion because of their dependency on the parent 
network element). 

Regarding claims 12 and 27: Gupta et al. as modified by Munger et al. discloses 
wherein said sequence of packets comprises a Denial-of-Service attack on said target 
host (see abstract of Munger et al.). 

Regarding claims 13 and 28: Gupta et al. as modified by Munger et al. discloses 
wherein said steps of applying said burst load, measuring said changes in said received 
packet rate, and determining said potential source of said sequence of packets, are 
executed under the control of an automated algorithm (see col. 7, lines 60-62 of Gupta 
et al.). 

Regarding claims 14 and 29: Gupta et al. as modified by Munger et al. discloses 
wherein said steps of applying said burst load and determining said potential source of 
said sequence of packets, are executed under the at least partial control of a human 
operator (see col. 7, lines 50-52 and 63-66 of Gupta et al.). 

Regarding claims 15 and 30: Gupta et al. as modified by Munger et al. discloses 
further comprising the step of displaying information, said information including data 
representative of said measured changes in said received packet rate, to said human 
operator, for use by said human operator in exercising said at least partial control (see 
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col. 7, lines 50-52 and 63-66 of Gupta et al., GUI's are commonly used to change 
settings). 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Brandon S. Hoffman whose telephone number is 571- 
272-3863. The examiner can normally be reached on M-F 8:30 - 5:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz R. Sheikh can be reached on 571-272-3795. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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